Slashdot Mirror
Mobile Users More Vulnerable To Phishing Attacks
Orome1 writes "Trusteer recently gained access to the log files of several web servers that were hosting phishing websites. Analyzing these log files provided visibility into how many users accessed the websites, when they visited them, whether they submitted their login information, and what devices they used to access the website. As soon as a phishing website is broadcast through fraudulent email messages the first systems to visit it are typically mobile devices. Most fraudulent emails call for immediate action. For example, they usually claim that suspicious activity has been detected in the user's account and that immediate action is required. Most victims who fall for this ploy will visit the phishing site quickly."
So, after reading the summary, we can conclude that the actual headline should be:
Mobile users more up to date with email than desktop users!
*facepalm*
which is totally what she said
iPhone users are 8 times more likely to engage phishing websites than Blackberry users. iPhone users account for 26% of the mobile market, Blackberry is 36%.
So the lesson is, if you use an iPhone - don't click on that link until you check it out the full email header on a PC. Unless you like living dangerously.
He who knows best knows how little he knows. - Thomas Jefferson
"Eight times more iPhone users accessed these phishing websites than Blackberry users."
Nevermind the default mail clients' interfaces; think of the demographics of these devices and the causality will immediately become clear.
If mobile users can’t tell the difference between real sites and fraudulent ones, that says something about the mobile device’s web browser, IMHO.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
My current mobile device, an iPhone, has a terrible native email client. There is no way to use text-only, view headers, or use pgp. I won't be surprised when a new email worm turns up that takes advantage of an image library that the iPhone mail.app uses. At least if I could view in text-only mode I wouldn't have to wait to click on suspected SPAM until I get to a real computer (Hey, you never know, "1 long 4u" might be an old girlfriend, not viagra SPAM).
We created this problem when we created the web. It is our ('our' being us the people who make their living building and maintaining the web) responsibility to solve it. We can't just tell people to monitor the arcane technical details over what is basically an issue of massive amounts of unpunished fraud crime. If left unchecked, the criminals will just get better and better technology.
We have to decide several things: one, we have to accept that law enforcement can not deal with this because they don't have the time and resources. So, it is our responsibility. Two, we have to decide what we are going to do about it. In other words, what will be effective in stopping this activity. Three: we have to do it. Which means we have to be cruel to people. Ordinary people who are just trying to make a sleazy buck. Cruel like in violence, because violence is the only way to enforce the law when the traditional law-enforcement mechanism can't respond.
I suggest private sting operations. We set up or let it be known that we will set up phishing sites for people, and then apply violence to anyone who pays us money to do it. People will stop buying phishing site product.
One big problem with this is the possibility that large criminal organizations will demand that we run the entrapment phishing sites for them. Being large criminal organizations, they have the resources of violence to make us do this. But then we can offer these people to traditional law enforcement. One more day in the 'system of power', as the Mafia calls it.
But we should take care of this problem. Otherwise we can't claim that there is any real benefit to the citizens in using the internet that we have so painstakingly created.
The term is not "vulnerable". Users are only vulnerable to real world things. Users are however, *gullible* and *susceptible" to phishing ploys. Especially iPhone users, apparently. *facepalm*
If someone can be suckered into paying the $$$ for a mobile internet device and suckered into the horrid price for the data plan and a locked in contract to subsidize the POS... that someone is a good candidate for being suckered on anything else.
There seem to be a lot of intervening variables (between "gullible" and "mobile user") which are unaccounted for in TFA.
Most of those are also likely magnified when "mobile user" is further reduced to "iphone user".
Mobile users have crummy email browsers that don't display full headers. Film at 11.
Sheesh.
I see no reason to use mail headers. It's obscure and "nobody" (general public) will know how to read them.
If people had a semblance of intelligence, they would know that email is inherently untrusted. EVEN if you had a game account, bank account, etc. with the phished company in question, I would never click on any link inside the email. I would go directly to the site itself by typing into a browser. Any notices that go through the email can be easily navigated or noted through the site itself.
There's my defense, preventing me from ever getting phished. Simple and even a retarded phone users can do it.
But they won't, because they want their shinies immediately.
the winD appeared never heeded
You can't look at the email headers on an iPhone, the mail app has no option for it.
If I have the time, I always visit a new phishing site and put in bank details. Not real ones, obviously. I'm hoping that maybe there is a slim chance that somewhere out there, I might have just annoyed a phisher.